Yahoo quickly fixes Flickr SQL injection, remote code execution flaws

Share this article:

A security researcher identified flaws in popular photo sharing service Flickr that could result in SQL injection and remote code execution, but Yahoo acknowledged and quickly patched the problems.

The SQL injection bugs open the door for remote code execution, Ibrahim Raafat wrote in a Saturday post, explaining he was ultimately able to obtain the MYSQL root password and gain access to sensitive information contained within the Flickr database. 

Raafat originally launched Flickr to check if a vulnerability he previously reported to Yahoo had been patched, but soon discovered two Blind SQL Injection vulnerabilities and a Direct SQL Injection flaw in the Flickr Photo Books feature.

The researcher reported the vulnerabilities to Yahoo and the internet corporation patched the problems within six hours, Raafat wrote.

Share this article:

Sign up to our newsletters

More in News

Five schools earn NSA's excellence in cyber ops distinction

The schools earned NSA's Centers for Academic Excellence designation for their cyber offerings.

With RATs at their disposal, 419 scammers target businesses

With RATs at their disposal, 419 scammers target ...

A new report reveals how Nigeria's 419 scammers are spreading malware to pocket business funds.

InfoSec pros worried BYOD ushers in security exploits, survey says

InfoSec pros worried BYOD ushers in security exploits, ...

A study by the Information Security Community on LinkedIn found most organizations don't have proper polices and support for BYOD.